Bug 134117 - Unreproducible crashes under WebCore::ScrollingTree::updateTreeFromStateNode() from messaging a deleted Obj-C object
Summary: Unreproducible crashes under WebCore::ScrollingTree::updateTreeFromStateNode(...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: Layout and Rendering (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Beth Dakin
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2014-06-20 13:28 PDT by Beth Dakin
Modified: 2014-06-20 22:14 PDT (History)
10 users (show)

See Also:


Attachments
Patch (5.05 KB, patch)
2014-06-20 13:32 PDT, Beth Dakin
no flags Details | Formatted Diff | Diff
Patch (5.78 KB, patch)
2014-06-20 13:47 PDT, Beth Dakin
simon.fraser: review+
simon.fraser: commit-queue-
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Beth Dakin 2014-06-20 13:28:32 PDT
There are many unreproducible crashes under WebCore::ScrollingTree::updateTreeFromStateNode() from messaging a deleted Obj-C object. We suspect that we could fix this if ScrollingStateNodes retained their LayerRepresentations. 

<rdar://problem/17149252>
Comment 1 Beth Dakin 2014-06-20 13:32:15 PDT
Created attachment 233446 [details]
Patch
Comment 2 Tim Horton 2014-06-20 13:35:36 PDT
Comment on attachment 233446 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=233446&action=review

> Source/WebCore/page/scrolling/ScrollingStateNode.h:179
> -        PlatformLayer *m_platformLayer;
> +        PlatformLayer* m_platformLayer;

the star was already on the right side
Comment 3 Beth Dakin 2014-06-20 13:47:25 PDT
Created attachment 233447 [details]
Patch
Comment 4 Simon Fraser (smfr) 2014-06-20 14:05:08 PDT
Comment on attachment 233447 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=233447&action=review

> Source/WebCore/page/scrolling/ScrollingStateNode.h:88
> +    LayerRepresentation(const LayerRepresentation& other)
> +        : m_platformLayer(other.m_platformLayer)
> +        , m_layerID(other.m_layerID)
> +        , m_representation(other.m_representation)

This fails to assign m_graphicsLayer.

> Source/WebCore/page/scrolling/ScrollingStateNode.h:133
> +    LayerRepresentation& operator=(const LayerRepresentation& other)
> +    {
> +        m_platformLayer = other.m_platformLayer;
> +        m_layerID = other.m_layerID;
> +        m_representation = other.m_representation;
> +
> +        if (m_representation == PlatformLayerRepresentation)
> +            retainPlatformLayer(m_platformLayer);
> +
> +        return *this;
> +    }

This fails to copy m_graphicsLayer.
Comment 5 Beth Dakin 2014-06-20 16:44:55 PDT
Thanks, Simon! http://trac.webkit.org/changeset/170224
Comment 6 Gyuyoung Kim 2014-06-20 22:14:53 PDT
(In reply to comment #5)
> Thanks, Simon! http://trac.webkit.org/changeset/170224

I add retainPlatformLayer() and releasePlatformLayer() to EFL port in order to fix a build break since r170224.

http://trac.webkit.org/changeset/170229